The signed catalog has homed grafana at lfg2025/grafana:10.2.0 in the fleet registry all along; the manifest still pulled Docker Hub's grafana/grafana, so the repo-mismatch guard (correctly) discarded the catalog image on every tick and warned every ~75s on every node. Registry verified to carry the image; aligning the repo path makes the already-signed catalog entry effective — no re-signing needed, no behavioural change beyond pull source. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>